Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on.

As far as I can tell, WBC has applications in reverse engineering protection, intellectual property protection, algorithm-key protection and various protections against attacks. Have I enumerated that properly?

There seems to be confusion regarding the terminology of white versus grey versus black box cryptography. Is there an agreed upon definition of each? Source?

I noticed that there are WBC for AES and DES. Are there other examples that are not related to those algorithms?

Thanks for any insights (and I have read of some of the postings on this site for WBC).

-A

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

There is a decent answer similar to this over on Cryptography at http://crypto.stackexchange.com/questions/386/differences-between-white-box-cryptography-and-code-obfuscation. To summarize briefly here, white box cryptography is specifically a type of code obfuscation for cryptographic keys in code. I'm not aware of any techniques that are actually secure for doing it, but the idea is that for a program to use encrypted data without user intervention, it must somehow store the cryptographic key within the code in such a way that the key can not be retrieved, but the code can be executed.

The primary places this would be useful is anywhere that a user or system should not have access to a key, but needs to be able to decrypt in given situations. Traditionally, the primary way to do this securely (not whitebox crypto) is through the use of a Trusted Platform Module or some other hardware that can perform cryptographic functions while restricting access to the key. White box crypto tries to do the same thing without the need for secure hardware storage.

You are quite correct that the ability to conceal a key from it's user is most practical in either DRM or code decompilation prevention since if the white box cryptography worked, it would only allow access to the protected data or code when going through the protected environment. I can't think of any other uses outside of those two.

share|improve this answer
    
Thank you for the response, I'll review your response and the nice reference. –  Amzoti Nov 26 '12 at 22:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.